I am designing a system which requires access control via a strong password and for that purpose will use a password generation algorithm A that produces a strong password of length L >= 32. The system would check for the password and, if the password is incorrect in several consecutive attempts, block the user from further logins for some period of time.
In addition, the system should:
- generate a long strong password
- password must be unique in the world,
- allow for an easy password change,
- require no authentication (i.e. users supply only password, but no user name),
- be simple in implementation and in use.
Because I have no hands-on experience in security issues, I would greatly appreciate if the security gurus could critique the following simple, and, perhaps naive, design:
- Invoke the same known algorithm A (say, a good one-way hash function, a UUID generation algorithm, etc.) T times, where T is a very big number, at least a billion.
- Record all T generated different passwords in a file, a password per line.
- The user shall pick a number N (perhaps randomly generated) between 1 and T and remember that number in his or her head.
- When asked for a password, the user would look in the file at position N, copy the password at that position and paste it to the program that asks for a password.
A. It appears that a person can remember a number between one and a billion without much trouble, as it has less digits than a US long distance phone number.
B. As long as the file is not lost (it can be replicated), the user will always have the right password.
C. The password can be changed easily any time by regenerating the whole file and picking a new password at the same position N. The user will not need to remember the new password -- using the same number N would result in a new password.
D. If an attacker gets a hold on the file with a billion passwords and tries repeatedly to login in order to find the correct password, then most likely it would take a very long time (years or may be centuries) because the system would keep blocking the user after just a few failed attempts.
E. Because of D, the password file can be kept in plain-text, no encryption is needed.
What is wrong with this kind of system?